02 — VPS DOT bin Proof

Read-only. Listing + header read of the four DOT/APR binaries under /opt/incomex/dot/bin.

All four handlers present and executable

Binary	Perms / owner	Size	mtime
dot-apr-health	-rwxr-xr-x incomex incomex	7822	Apr 4 04:50
dot-apr-propose	-rwxr-xr-x root root	10138	Apr 20 05:31
dot-apr-execute	-rwxr-xr-x root root	27116	Apr 20 04:33
dot-dot-register	-rwxr-xr-x incomex incomex	5813	Apr 4 04:50

All four are world-executable (-rwxr-xr-x) and readable from this terminal.

dot-apr-execute header (first 40 lines) — key facts

• dot-apr-execute — Thực thi APR đã approved (Cấp B + SYNC_SECRET)
• VERSION: 2.2.0
• v2.2.0 (2026-04-20): fix SUMMARY counters; auto-invoke verify_callback.
• v2.1.0 (2026-04-20): Implement patch_ops_code handler (real, replaces STUB). Contract: proposed_action JSON {dot_code, file_path, patch_mode (full_replace|unified_diff), new_content_base64 OR diff, session_code, test_plan}. Flow: flock -> backup .bak-{session} -> apply -> bash -n (Tầng 1 syntax) -> atomic mv -> vps_deploy_log (deploy_kind='ops-code'). Rollback on any failure.

Why this matters for W7

• The patch_ops_code handler is REAL (since v2.1.0), not a stub. This is the governed deploy vehicle that the W7 prerequisite (execute_authorize_build_step handler) would be deployed through — confirming the deploy vehicle physically exists and is reachable.
• dot-apr-execute is a Cấp B tool requiring SYNC_SECRET (see file 03).

Criteria status (this file)

• read /opt/incomex/dot/bin: YES (confirmed in detail)
• DOT handler binaries exist & executable: YES